Is CVE-2026-89068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89068 being exploited in the wild.

How severe is CVE-2026-89068?

High severity, with a CVSS score of 8.1, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89068?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89068 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89068?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89068: Progress MOVEit Transfer authentication bypass in LDAP module

CVE-2026-89068 · Severity: high · CVSS 8.1 · Published 2026-10-14

MOVEit Transfer is a managed file transfer solution used by organizations to securely exchange data. A missing authentication step in the LDAP module allows attackers to bypass authentication and gain unauthorized access to the system. An attacker could use this flaw to access sensitive files and data without valid credentials.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89068 being exploited in the wild.
How severe is CVE-2026-89068?: High severity, with a CVSS score of 8.1, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89068?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89068 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89068?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

A missing critical step in the LDAP authentication process allows attackers to bypass authentication without providing valid credentials. The vulnerability affects the LDAP module component of MOVEit Transfer. This flaw can be exploited over the network to gain unauthorized access to the transfer system and its data.

Affected products

Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.